Re: [Announce] Non Invasive Kernel Monitor for threads/processes

[Chris Friesen <cfriesen@nortelnetworks.com>]

Sabharwal, Atul wrote:

> How does auditing work in the event of a process failure ? There would
> be
> no system call triggered in that case.  Also, my initial thoughts are
> that the non-invasive Kmonitor is lesser performance impact when
> compared
> to auditing. I would spend some time developing sample code to confirm
> it.

Just to put in my $.02.  We developed a very simple (even simpler than Kmonitor 
in that it didn't track fork/exec) way for a process to get notified when other 
processes exited (properly or otherwise).  We want to use this in the field for 
a lifecycle monitoring function (a sort of super-init) so it needs to be as 
lightweight as possible.  I'd love to be able to use something from the mainline 
kernel, but it has to be field-runnable without slowing stuff down.

Chris